BlockBeats report: On July 1, SlowMist issued a security alert, detecting a coordinated malicious npm supply chain attack in which attackers deployed JavaScript information stealers through fake trading bot repositories and DeFi-themed npm packages, targeting npm users, DeFi developers, and trading bot users. The attack involved 30 malicious npm packages, with stake-math@3.5.4 appearing as a locked dependency in the donoaccestag/forex-mt5-trading-bot repository. This repository exhibited approximately 2,300 highly homogenized bulk-generated forks, mostly concentrated under the poly-stocks account, signaling clear malicious intent.
Attackers can steal a wide range of sensitive data, including cryptocurrency wallet databases, browser cookies and saved passwords, browsing history, developer credentials, shell history, password manager databases, private keys, seed phrases, and API tokens exposed in source code. SlowMist recommends that developers immediately remove the affected npm packages, audit their package.json and package-lock.json files as well as CI logs for any of the 30 malicious packages; treat any system that executed npm install as potentially compromised, rotate all exposed wallets, private keys, npm tokens, cloud credentials, SSH keys, and API tokens, and rebuild affected environments from clean images.